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Correlation of signalling messages 

[30990122] 

Technical Field 

This invention relates to correlation of signalling messages conforming to different 
protocols, for example for bearer identifier discovery in a distributed switch environment. 



Background Art 

Existing telecommunications networks, for example the international public switched 
telephone network (PSTN) are typically configured so that equipment (such as switches) in 

10 the transmission or bearer network, which carries user traffic (voice and data signals), is co- 
located with equipment (such as signalling points) in the associated signalling network, 
which carries control signals for coordinating the operation of the bearer network. 

However, attention is now being directed to the possibility of telecommunications 
networks comprising distributed telecommunications switches, in which there is a separation 

15 of the switching/adaptation functionality from the signalling functionality. Furthermore, 
consideration is being given to the possibility of connecting dissimilar such networks (i.e. 
networks relying on different bearer technologies and/or signalling protocols). 

Dissimilar telecommunications networks are typically interconnected via a "gateway" 
which provides the necessary conversions or adaptations between the bearer traffic and 

20 signalling protocol in each of the networks. In such an architecture control devices such as 
Media Gateway Controllers can be physically remote from the adaptation devices, such as 
Media Gateways. Media Gateway Controllers can communicate with the Media Gateways 
they control using protocols such as Simple Gateway Control Protocol (SGCP), Media 
Gateway Control Protocol (MGCP), and the Megacop/H.248 protocol currently being 

25 defined. Media Gateway Controllers communicate with each other using extensions of 
current Call Control protocols such as Signalling System No.7 ISDN User Part (SS7 ISUP), 
Session Initiation Protocol (SIP - IETF RFC 2543), or ITU Recommendation H.323. New 
protocols may be defined for this interface in the future. 

Protocol monitoring applications, such as tracing across a signalling network the 

30 protocol messages associated with a call, or building Call Data Records (CDRs) to 
summarise the key parameters relating to a call, require the ability to correlate across 
different protocols, which may refer to a single entity in multiple different, inconsistent ways. 
It is an object of this invention to facilitate such correlation. 

35 Disclosure of Invention 

According to one aspect of this invention there is provided a method of establishing a 
correlation between the contents of signalling messages conforming to different protocols but 
relating to a common bearer data item, comprising the steps of: 
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monitoring messages traversing at least first and second signalling channels which 
conform to respective first and second signalling protocols; 

selecting first messages containing an identification related to an end user of said 
bearer data item and a first identification of a bearer channel carrying said bearer data item; 
5 selecting second messages containing a second identification of a bearer channel' 

carrying said bearer data item and a call identifier with system-wide significance; 

selecting third messages containing an identification related to an end user of said 
data item and a call identifier with system-wide significance; and 

using said selected third messages to establish a correlation between the first and 
1 0 second bearer channel identifications . 

According to another aspect of this invention there is provided a method of 
establishing a correlation between the contents of signalling messages conforming to 
different protocols but relating to a common bearer data item, comprising the steps of: 

monitoring messages traversing at least first and second signalling channels which 
conform to respective first and second signalling protocols; 

selecting first messages containing an identification related to an end user of said 
bearer data item and a first identification of a bearer channel carrying said bearer data item; 

selecting second messages containing a second identification of a bearer channel 
carrying said bearer data item and a transaction identifier; 

selecting third messages containing an identification related to an end user of said 
data item and packet network address information; 

selecting fourth messages containing packet network address information and a 
transaction identifier; and 

using said selected third and fourth messages to establish a correlation between the 
25 first and second bearer channel identifications. 

According to a further aspect of this invention there is provided a method of 
establishing a correlation between the contents of signalling messages conforming to 
different protocols but relating to a common bearer data item, comprising the steps of: 

monitoring messages traversing at least first and second signalling channels which 
30 conform to respective first and second signalling protocols; 

selecting first call initiation messages containing a first identification of a bearer 
channel carrying said bearer data item; 

selecting second call initiation messages containing a second identification of a bearer 
channel carrying said bearer data item; 
35 determining elapsed time between occurrence of said first and second messages; and 

establishing a correlation between first and second messages for which the elapsed 
time is below a predetermined threshold, and thus between the first and second bearer 
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channel identifications. 

According to another aspect of this invention there is provided apparatus for 
establishing a correlation between the contents of signalling messages conforming to 
different protocols but relating to a common bearer data item, comprising: 
5 monitoring equipment for monitoring messages traversing at least first and second 

signalling channels which conform to respective first and second signalling protocols; 

a first selector for selecting first messages containing an identification related to an 
end user of said bearer data item and a first identification of a bearer channel carrying said 
bearer data item; 

JO a second selector for selecting second messages containing a second identification of 

a bearer channel carrying said bearer data item and a call identifier with system-wide 
significance; 

a third selector for selecting third messages containing an identification related to an 
end user of said data item and a call identifier with system- wide significance; and 
75 a correlator for establishing a correlation between the first and second bearer channel 

identifications in accordance with said selected third messages. 

According to a further aspect of this invention there is provided apparatus for 
establishing a correlation between the contents of signalling messages conforming to 
different protocols but relating to a common bearer data item, comprising: 
20 monitoring equipment for monitoring messages traversing at least first and second 

signalling channels which conform to respective first and second signalling protocols; 

a first selector for selecting first messages containing an identification related to an 
end user of said bearer data item and a first identification of a bearer channel carrying said 
bearer data item; 

25 a second selector for selecting second messages containing a second identification of 

a bearer channel carrying said bearer data item and a transaction identifier, 

a third selector for selecting third messages containing an identification related to an 
end user of said data item and packet network address information; 

a fourth selector for selecting fourth messages containing packet network address 
30 information and a transaction identifier; and 

a correlator for establishing a correlation between the first and second bearer channel 
identifications in accordance with said selected third and fourth messages. 

According to another aspect of this invention there is provided apparatus for 
establishing a correlation between the contents of signalling messages conforming to 
35 different protocols but relating to a common bearer data item, comprising: 

a monitor for monitoring messages traversing at least first and second signalling 
channels which conform to respective first and second signalling protocols; 
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a first selector for selecting first call initiation messages containing a first 
idennfication of a bearer channel carrying said bearer data item- 

a second selector for selecting second call initiation messages containing a second 
.dentification of a bearer channel carrying said bearer data item; 

a monitor for determining elapsed time between occurrence of said first and second 

messages; and 

the elapsed fame is below a predetermined threshold, and thus between the first and second 
bearer channel identifications. 



Brief Descrip tion of Drawing 

A method and apparatus in accordance with this invention, for correlation of 
s.gnalungme^ 

15 ^h ^ 

Figure 1 shows the topology of an exemplary network incorporating multiple 

telecommunications media and distributed switches; 
Figure 2 shows a possible sequence of signalling messages used to set up a call 
across a network such as that of Figure 1; and 
20 Figure 3 lists protocol fields which may be used to correlate messages relating 

to a smgle call traversing multiple telecommunications media. 

Best Mode for C a rrvin B Out th* in^ on . & Tnd „ sfrial ^ KrMttty 

Referring to Figure 1, a Media Gateway Controller (MGC) 10 and an associated 
Med. Gateway (MG) 12 link the public switched telephone network (PSTN) 14 to a packet 
network 1 6, which in this example is shown as using Asynchronous Transfer Mode (ATM) 
technology. The PSTN 1 4 uses SS7 ISUP over its signalling links 1 8 to the MGC, and tim 
d™ n multiplexing (TDM) for transmission of user traffic (for example voice calls and 

other bearer data items) overits transmission or bearer channels 20 to theMG 12 The MGC 
Oexch^g^ 

t^lx^ V ° iCe CaUS ' in 1,16 form ° f V ° iCe ° Ver A ™ — ges, to a^d from 

IfTT 160VerATMch ^ els24wWchals -^ATMsigna,,mgmessagesin 
conventual manner. The MGC 10 controls the MG 12 via a link 26 carrying MGCP 

J J messages. 7 6 

Fig ^ 2sh0Ws ^ 

such a network, as follows: mi across 
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1 . the PSTN 14 sends an Initial Address Message (IAM) to the MGC 10; 

2. the MGC 10 then sends a Create Connection (CRCX) message to the MG 12, to 
define an endpoint for a packet network connection over the channels 24; 

3. when this has been accomplished the MG 12 returns an OK acknowledgement 
5 containing address information for the packet network endpoint, coded.as a Session 

Description Protocol (SDP - RFC 2327) Connection Description Parameter; 

4. thereafter the MGC sends another IAM over the link 22 to the packet network. 

In calls controlled by a single MGC message number 4 does not occur. For a call in the 
opposite direction, i.e. terminating in the PSTN, the same messages would occur but the 

10 messages 1 and 4 would be interchanged. 

Although the different messages on their respective links all relate to the same overall 
call or transaction, the different ways in which their respective protocols identify the call (e.g. 
by reference to the subscriber, or to the equipment used to carry the call, or to an arbitrary 
reference number) prevent a simple association of these messages to derive a complete 

15 description of the call. Such descriptions are desirable, for example, to build Call Detail 
Records for billing and other management functions, or in order to trace progress of the call 
through the system during fault finding. 

Figure 3 highlights fields in (by way of example) the SS7 and MGCP protocols which 
may be used to correlate messages belonging to a single call traversing the network shown in 

20 Figure 2. The PSTN trunk associated with a call is identified in the SS7 ISUP (or Telephone 
User Part - TUP) signalling by the combination of Destination Point Code (DPC), 
Originating Point Code (OPC) and Circuit Identification Code (CIC) fields, as defined in the 
ITU's Recommendation Q.767. In the MGCP protocol used between the MGC and the MG, 
the same trunk is identified by an endpointname of the form 

25 localEndpointname@Domainname, where localEndpointname is a character string, and 
Domainname is a Domain name as defined by the Internet Engineering Task Force's 
document RFC 821 . In order to associate, say, an SS7 ISUP call protocol sequence with the 
corresponding MGCP protocol sequence, it is necessary to be able to correlate these two 
identifications. 

30 The invention enables the association between the SS7 OPC-DPC-CIC trunk 

identification and the endpointname used by the MGCP (or any similar protocol ) to be 
discovered and stored for subsequent use by any appropriate application program, such as for 
billing. 

To this end, the various signalling links and channels in the network surrounding the 
35 MGC 1 0 are provided with passive monitoring devices 28 and 30 as shown in Figure 2. For 
monitoring SS7 links Hewlett-Packard acceSS? monitoring equipment may be used; for 
other channels (e.g. ATM or IP) equipment of similar functionality with interfaces adapted to 
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match those technologies would be used. The monitoring devices 28 and 30 detect and 
generate copies of all signalling messages traversing the links and channels around the MGC 
1 0. These copies are then transferred, for example via a local area network, to a monitoring 
control centre 32, which typically comprises data storage equipment and associated data 
processing equipment operating under the control of appropriate software program 
instructions to perform the required analyses of the data collected. 

Using the data thus acquired, a table of associations between OPC-DPC-CIC 
identifications and endpointnames can be built by the monitoring control centre 32. For this 
purpose the required associations are deduced as follows: 

- where an IAM between MGC's (inter-MGC IAM) is generated following the arrival 
of an SS7 IAM (or vice versa), these two messages can be correlated by the 
combination of Calling & Called address parameters; 

- the SDP connection description parameter included in inter-MGC IAMs and MGCP 
OK messages can be used to correlate these messages; 

- the MGCP OK message can be correlated with the MGCP CRCX message using the 
transaction ID included in both of them. 

Thus each pair of message types described above provides a step in a sequence by which all 
four types of messages can be associated as relating to a single call: SS7 IAM with inter- 
IAM; inter-IAM with MGCP OK; and MGCP OK with MGCP CRCX. This in turn enables 
the required correspondence to be deduced between an MGCP endpointname (in the CRCX 
message) and an ISUP OPC-DPC-CIC identification (in the SS7 IAM). 

This requires the buffering of initial IAM and MGCP messages for a short time, for 
example in the monitoring control centre, until the associated messages on the other links 
occur and can be detected. 

Another way of making an association (although it is only tentative in nature) is to 
correlate the OPC-DPC-CIC identification from the SS7 IAM with the endpointname in an 
MGCP CRCX message which occurs within a predetermined short time interval after the 
IAM arrives (and provided no other such IAM messages occurberween the times the chosen 
IAM and the CRCX are monitored, and also provided no subsequent CRCX messages are 
monitored during a suitably long time period thereafter). Associations detected in this 
manner should be marked as 'suspected' rather than 'known' in the table, until they can be 
confirmed by the first technique described above. This approach may speed up the discovery 
process in cases where a high proportion of calls are controlled by a single MGC. 

This alternative method can be refined by eliminating from consideration any 
messages containing OPC-DPC-CIC identifications or endpointnames already present (as 
'known') in the association table. This increases the probability that the messages under 
cons.deration will reduce to a single IAM and CRCX pair. As the table of discovered 



associations becomes more nearly complete, this method becomes more successful. 

The association table can be accessed in use by protocol monitoring applications 
which need to establish linkages between messages relating to a particular call. Depending 
on the particular type of application, * suspected' associations could be either ignored or used, 
with an appropriate warning to the application user. 

The techniques described above eliminate the need for error-prone manual 
configuration of an association table, as has been previously required. They rely only on 
standardised protocol message formats, and thus avoid the possible need to deal with 
multiple, proprietary, vendor-specific Operation Support System (OSS) interfaces as would 
be required if data to build the association table were extracted from such OSSs. 

The invention has been described by way of example in the context of SS7 and 
MGCP protocols. However, it will be understood that the invention is equally applicable in 
connection with the use of any other protocol defining messages which contain indications of 
end users and/or bearer channels. 
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CLAIMS 

1. Amethod of establishing a correlation between the cont^ts of signalling J^^^^ 
sCoT 8 1 ° differentpr0tOCOlS bUt * - corrunonbearerdatai.em.compnsingthe 

monitoring messages traversing at least first and second signalling channels which 
conform to respective first and second signalling protocols; 

selecting first messages containing an identification related to an end user of said 
bearer data lt em and a first identification of a bearer channel carrying said bearer data item- 
selecting second messages containing a second identification of a bearer channel 
carrying said bearer data item and a call identifier with system-wide significance- 

- selecting thud messages containing an identification related to an end user of said 
data item and a call identifier with system-wide significance; and 

using said selected third messages to establish a correlation between the first and 
second bearer channel identifications. 

2- A method of establishing a correlation between the contents of signalling messages - 
cojaformmg^^ 
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monitoring messages traversing at least first and second signalling channels which 
conform to respective first and second signalling protocols; 

selecting first messages containing an identification related to an end user of said 
bearer data item and a first identification of a bearer channe. carrying said bearer data item- 

selecting second messages containing a second identification of a bearer channel 
carrying said bearer data item and a transaction identifier; 

selecting third messages containing an identification related to an end user of said 
data item and packet network address information; 

selecting fourth messages containing packet network address information and a 
transaction identifier; and 

_ using said selected third and fourth messages to establish a correlation between the 
first and second bearer channel identifications. 
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^ me method of claim 2, wherein the fourth messages comprise responses to said 

second messages. 

ISUP J£ 7.H ° d ^ 01,6 "** PreCedinS daimS ' Wh6rein *° ™ SS7 

ISUP Initial Address Messages, the end user identification comprises ^ calling and called party 

addresses, and the first bearer channel identification comprises an OPC-DPC ^ 
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combination. 

5. The method of any one of the preceding claims, wherein the second messages are 
MGCP Create Connection messages and the second bearer channel identification comprises 

5 endpoint identifier parameters. 

6 . The method of any one of the preceding claims, wherein the third messages are ISUP 
Initial Address Messages and the end user identification comprises calling and called party 
addresses. 

10 

7. The method of claim 2, wherein the fourth messages are MGCP Response messages, 
the packet network address information comprises an SDP connection descriptor parameter, 
and the transaction identifiers comprise transaction ID parameters. 

15 8. A method of establishing a correlation between the contents of signalling messages 
conforming to different protocols but relating to a common bearer data item, comprising the 
steps of: 

monitoring messages traversing at least first and second signalling channels which 
conform to respective first and second signalling protocols; 
20 selecting first call initiation messages containing a first identification of a bearer 

channel carrying said bearer data item; 

selecting second call initiation messages containing a second identification of a bearer 
channel carrying said bearer data item; 

determining elapsed time between occurrence of said first and second messages; and 
25 establishing a correlation between first and second messages for which the elapsed 

time is below a predetermined threshold, and thus between the first and second bearer 
channel identifications. 

9. The method of claim 8, wherein establishment of a correlation between first and 
30 second messages is also dependent upon absence of any similar messages within a 

predetermined time interval. 

10. The method of claim 8, wherein the first messages are SS7 ISUP Initial Address 
Messages, the end user identification comprises calling and called party addresses, and the 

35 first bearer channel identification comprises an OPC-DPC-CIC combination. 



11. 



The method of claim 8, wherein the second messages are MGCP Create Connection 
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P "3 re and second bearCT chanDel identification "-^ end ^ 

12 A method of establishing a correlation between the contents of signalling messages 
hereinbefore described with reference to the accompanying drawings. 
13. APP-^toe-tAli^ 

si ma „ m T nn f eq ? mem ^ m0nit0ri118 meSS3geS ^ least first and second 

.gnalnng channels winch conform to respective first and second signalling protocols- 
end' a ;* s ;^ torf ^ 

simile C3nyin ' S3id b6arer ^ itCm ^ 3 0311 

enduser of Sal d data item and a call identifier with system-wide significance; and 

idenri *r elatorfor ^^ 

identifications in accordance with said selected third messages. 

14. Apparatus for establishing a correlation between the contents of signalling messages 
"^todiffe^^ 

siCT „ m T nn f eqUiPmCnt m0nit ° ring meSSageS a, least first and second 

signalling channels which conform to respective first and second signalHng protocols . 

end 3 r ^^ 86160 ^^^ 65 ^ 3 ^ 

30 aS6COndse1 ^^^ 

a bearer channel carrying said bearer data item and a transaction identifier 

endn/T^JT^^ 

end user of said data item and packet network address information- 

35 infonnif Urth / e l!! t0r ^ ***** ^ m ""«" net ™* address 

35 information and a transaction identifier; and 

aconrelatorforestabhs^^^ 
.dentificabons .n accordance with said selected third and fourth messages. 
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1 5 . Apparatus for establishing a correlation between the contents of signalling messages 
conforming to different protocols but relating to a common bearer data item, comprising: 

a monitor for monitoring messages traversing at least first and second signalling 
channels which conform to respective first and second signalling protocols; 

a first selector for selecting first call initiation messages containing a first 
identification of a bearer channel carrying said bearer data item; 

a second selector for selecting second call initiation messages containing a second 
identification of a bearer channel carrying said bearer data item; 

a monitor for detennining elapsed time between occurrence of said first and second 
messages; and 

a correlator for establishing a correlation between first and second messages for which 
the elapsed time is below a predetermined threshold, and thus between the first and second 
bearer channel identifications. 

1 6. Apparatus for establishing a correlation between the contents of signalling messages 
confomiing to different protocols but relating to a common bearer data item, substantially as 
hereinbefore described with reference to the accompanying drawings. 
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ABSTRACT 
Correlation of signalling messages 



switch t! 0lmin8 10 ' rotoc ° ls » * <JZS 

acco dmg to parang they have in common. Inter-MGC lAMs and SS7 IAMs 2 
correla ted by the combination of CaUing & Called address parameters; the co^ 

c^x t*;;: mes T : ^ 4,16 mgcp ok message - be «— - ^ «. 

? m8 thetranSaCti0nID - H^eacorrespondencecanbe deduced between 



(Fig. 3) 
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